Mandiant Details ARMORY CASTLE’s Exploitation of BeyondTrust Remote Support
Summary
Mandiant reports ARMORY CASTLE exploited CVE-2026-102764 as a zero-day, using custom malware to gain persistent root access, target credentials and move through BeyondTrust Remote Support environments. It urges patching and investigation.
Key points
- Mandiant says the suspected PRC-nexus actor ARMORY CASTLE exploited CVE-2026-102764 in late August 2026, before BeyondTrust disclosed it.
- The vulnerability affects supported BeyondTrust Remote Support versions up to 26.2.3 and allows unauthenticated file operations that can lead to host-level control.
- The SAWFLY PHP webshell used obfuscated, encrypted command-and-control; a SUID-enabled shell copy and startup configuration changes provided root access and persistence.
- The actor attempted to extract credentials from BeyondTrust’s secrets database, changed administrator permissions, and accessed internal endpoints and documents.
- The BARECLAW tool provided SOCKS5 tunneling over WebSockets; the actor modified HAProxy configuration to route internet traffic to it.
- Mandiant observed log deletion and other anti-forensic activity, so on-appliance logs may not show the full exposure.
- Mandiant recommends immediate patching, preserving external logs, isolating or rebuilding suspected appliances, rotating credentials after remediation, and reviewing sessions and permission changes.
Article Details
- Attack Vectors
- ARMORY CASTLE exploited CVE-2026-102764 as a zero-day against BeyondTrust Remote Support appliances, enabling unauthenticated file operations.
- The actor staged the SAWFLY PHP webshell, then used a root-owned SUID copy of /bin/sh and a startup script that modified the sudoers template to establish persistent root access.
- The actor attempted to extract credentials from the appliance vault using the native bt-secrets utility and deleted related logs.
- The actor used compromised Administrator credentials to change Jump Item and Team permissions, access downstream systems, and transfer files from user desktops.
- The actor deployed BARECLAW as a SOCKS5-over-WebSocket tunneler and modified HAProxy routing to expose its endpoint through the appliance.
- Defensive Notes
- Apply the BT26-05 patch; treat vulnerable internet-reachable appliances as potentially compromised until reviewed.
- Preserve appliance and external logs before changes, isolate suspected appliances at the perimeter, and rebuild confirmed or potentially compromised appliances from a clean, patched image.
- After patching or rebuilding, revoke sessions and enrollments, rotate credentials stored or used by the appliance, and review account, role, API, Jump Item, and configuration changes.
- Forward syslog and collect reverse-proxy, WAF, and perimeter firewall logs; investigate unknown PHP paths, unexpected WebSocket upgrades, unusual administrative logins, file transfers, and gaps in log forwarding.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462 | SHA-256 hash listed for the BARECLAW tunneler file ingredi_ws. |
| SHA256 | dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb | SHA-256 hash listed for the SAWFLY webshell file mangoapi.php. |
MITRE ATT&CK
T1005 · Data from Local SystemThe actor used the Remote Support file transfer service to obtain documents from user desktops.T1037.004 · RC ScriptsThe actor created a script in the appliance's post_boot.d directory to reapply passwordless root privileges at startup.T1059.004 · Unix ShellThe actor executed Unix shell commands and a shell script to alter permissions, configure persistence, and delete logs.T1070.002 · Clear Linux or Mac System LogsThe actor deleted system, web server, application, and bt-secrets logs to hinder detection.T1071.001 · Web ProtocolsSAWFLY used HTTP POST requests for its bidirectional command-and-control communication.T1078 · Valid AccountsThe actor used compromised Administrator credentials to log into the BeyondTrust administrative portal.T1090.001 · Internal ProxyBARECLAW provided a SOCKS5 proxy that relayed TCP connections through the compromised appliance.T1098 · Account ManipulationThe actor changed the compromised account's Jump Item and Team permissions from No Access to Administrator.T1190 · Exploit Public-Facing ApplicationARMORY CASTLE exploited CVE-2026-102764 against internet-reachable BeyondTrust Remote Support appliances.T1505.003 · Web ShellThe actor established a foothold with the SAWFLY PHP webshell.T1548.001 · Setuid and SetgidThe actor copied /bin/sh to /usr/bin/dbus-authd, made it root-owned, and enabled SUID permissions.T1555.005 · Password ManagersThe actor used the appliance's bt-secrets utility to attempt to retrieve credentials from its native vault.T1572 · Protocol TunnelingBARECLAW carried tunneled traffic over WebSocket connections routed through HAProxy.